Workspace ONE UEM can be configured to provide your shift workers, and other roles that share devices, access to corporate resources. Different apps, policies, and branding can be provided based on a users role. To ensure user privacy, certain apps can have their app data cleared between user sessions.
- Shared Bank Teller Android device in Financial Services
- Shared Nurse Android device in Healthcare
- Shared mobile Point of a Sale Android device in the retail industry.
This guide assumes you have knowledge of certain workflows in the Workspace ONE UEM console, and have completed certain steps already:
- The Android EMM registration is complete using managed Google accounts.
- Smart groups are already created. If a certain group of users need a different set of policies and/ or apps, separate smart groups are created for them.
- Internal and/ or private apps for your users are added into the Workspace ONE UEM Console.
- Android devices are running OS version 8.0 or higher.
- User accounts for your users have been added to the Workspace ONE UEM Console.
- Profiles for applying device policies and network configuration should be created and assigned to your users.
The best option for the shared device use case is to use Work Managed enrollment with device based accounts. This is based on two key assumptions:
- Devices used for shared devices typically do not have a single end user associated with them.
The enrollment occurs at a central location and then shipped to the location where the devices are used.
Configure Device-based Accounts
- Create a Multi-user Staging Account for Enrollment
- Creating a QR code for Enrollment
Configure Device-based Accounts
Device based accounts is only available when Android EMM is registered using managed Google Accounts.
Device based accounts adds a unique managed Google account on each device, even if the enrollment user is the same. This is important because Google limits how many devices can be used by a single user (limited to 10). With device based accounts, any number of devices can be enrolled with the same user.
To configure device-based accounts in the Workspace ONE UEM console:
- Navigate to Groups & Settings > All Settings > Devices & Users > Android > Android EMM Registration > Enrollment Settings.
- Set the Work Managed Enrollment Type to Device-Based.
Create a Multi-user Staging Account for Enrollment
Enrolling a device using a multi-user staging account sets up the device for shared use. The device downloads the Workspace ONE UEM Launcher and you users login in using Launcher. Additionally, the multi-user staging account simplifies bulk enrollment by enabling you to enroll all your shared devices with this account.
To create a multi-user staging account, follow these steps:
- Navigate to Accounts > Users > List View > Add User.
- Add the Username, Full Name, E-mail, and Password for the account in the General tab.
- Enable Multi User Devices under Advanced > Staging.
- Click Save
Creating a QR code for Enrollment
To ensure that the enrollment is easy to perform in bulk, the best option is to use a QR code. A QR code can be created within the Workspace ONE UEM console that includes server details, group ID and authentication details. By simply scanning the QR code during the out of box setup, the device enrolls without any further interaction.
To create a QR code in the Workspace ONE UEM console:
- Navigate to Lifecycle > Staging > List view.
- Click Configure Enrollment.
- Navigate to Android > QR Code and select Configure.
Connect the device to Wi-Fi prior to enrollment by enabling the Wi-Fi toggle. This enabling action displays the following options.
||Enter the Service Set Identifier, more commonly known as the name of the Wi-Fi Network.
||Enter the Wi-Fi password for the entered SSID.
- Select the Workspace ONE Intelligent Hub to push to devices during staging. The default selection is Use latest Workspace ONE Intelligent Hub. If you do not have an Workspace ONE Intelligent Hub added, select Hosted on an external URL and enter the address in the URL text box to point to an externally-hosted Workspace ONE Intelligent Hub Package.
- Select Next.
- Set the Enrollment Details settings. To use token-based authentication, leave both options disabled.
Configure Organization Group
||Enable and select the organization group to enroll the device into.
Configure Login Credentials
||Enable to configure login credentials. Enter the username of the staging account created earlier.
||Enter the corresponding password for the staging user
- The Summary page allows you to the download the QR code as a PDF file.
You can use this QR code for enrolling your Android devices into Work Managed mode.
Workspace ONE UEM Launcher Configuration
VMware Workspace ONE UEM Launcher provides a highly customizable experience for your shift workers. You can add custom branding, set app icon positioning, and configure which device settings they should have access to.
Prior to creating a Launcher profile, you should add any internal and/ or public applications that will be used by your shift workers into the Workspace ONE UEM console.
If your shift workers need to have a different set of apps or settings available to them based on their role, you must create multiple Launcher profiles and assign them to the different smart group(s) created based on the role.
Create a Launcher Profile
- Navigate to Devices > Profiles & Resources > Profiles > Add > Add Profile > Android.
- Under the General Tab, provide a name for the profile and assign the profile to smart group(s) that include your shift workers.
- Select the Launcher payload, click Configure.
- Select Multi App.
- Drag and drop applications from the left to the canvas on the right.
- Adjust the positioning of the app icon to ensure that shift workers get a consistent experience on any device they sign into at the start of the shift.
- You can use the Create Folder option at the top of the canvas to organize your apps for your shift workers.
- Under the Layout, add a custom wallpaper, if desired.
- Under the Settings dropdown, you can enter an administrative passcode that enables you to exit out of the launcher screen for troubleshooting.
- Additionally, you can also customize which settings your users can access. Once you're done customizing settings, click Save.
- Click Save to complete the Launcher configuration.
- Click Save and Publish.
For advanced use cases that are not available in the Launcher profile, you can refer to this page.
Clear Data Between User Sessions
You can choose to clear app data for all apps between user sessions.
- Navigate to Devices & Users > General > Shared Device > Logout Settings.
- Enable Clear Android App Data and Clear Android Device Passcode.
Enrolling a Device Using a QR Code
- Power on the device. The setup wizard prompts the user to tap the Welcome screen six times. The taps have to be done in the same place on the screen.
- For Android 8.0 devices, proceed to step 2 in order to download the QR Code reader.
- For Android 9.0 and later devices, the camera will open automatically after you complete the six taps, so you can skip to step 3.
- Connect to Wi-Fi and the setup wizard automatically downloads a QR code reader. The QR code reader app automatically starts once complete.
- Scan your QR code. For Android 9.0 or later devices, use the QR code option on the camera to scan.
- The setup wizard automatically downloads the Workspace ONE Intelligent Hub and enrolls the device using the staging user you created earlier.
- After enrollment is complete, Workspace ONE Launcher then downloads and launches.
The device is now ready for your shift workers to sign in.